-: Performance-Based Questions.
In this lesson, I want to give you a quick overview
of the performance-based questions and what kind of things
you might need to be able to do on test day.
So the first thing I want to talk about
is a couple of quick tips and tricks.
What exactly is a performance-based question?
Well, you might hear people calling them simulations,
and that's really what they are.
But CompTIA calls them PBQs, or performance-based questions,
and when you go to sit down for test day,
they are the first questions you're going to be given.
So when you hit start on that exam,
the first three or four questions are going to be simulations,
performance-based questions.
And then once you get through those,
they'll give you the multiple choice.
Now, a couple of things to note
with performance-based questions.
One of the big issues that students have
with performance-based questions is they take a lot of time,
and students lose track of time in them,
because when you're doing a performance-based question,
you don't see the countdown time.
So one of the things I recommend that works really well
for CompTIA exams is to mark
all of these questions for review.
Mark all those simulations for review and skip them.
Don't read 'em,
don't even try to attempt 'em your first time through.
Instead, I want you to skip them and start going
through all of your multiple choice questions,
which will be 70 or 75 questions on exam day.
Go through all of them, and you'll still have plenty of time
to go back and do those simulations.
The other reason I recommend this
is that the simulations are hard, right?
And so a lot of times,
it will just rip your confidence from you,
and then you start doing poorly on the multiple choice.
Instead, go knock out all the multiple choice,
they're much easier,
and then come back to those harder simulation questions.
So I want you to mark them for review, skip them,
go do all your multiple choice,
come back and do the simulations,
and then if you still have time,
go through your multiple choice again
and verify your answers.
If you do this,
you're going to increase your score dramatically on test day.
Now, now that I've gotten the tips and tricks out of the way,
let's talk about the simulations themself.
In this lesson, I'm going to go through several examples
of the types of things you need to be able to do
to perform well on test day.
Now the first one is you have to be able
to read a vulnerability report.
So if somebody gives you something that looks like this,
this is a Nessus scan result for vulnerability.
Now on the exam, they're not going to test Nessus explicitly,
but they are going to test something
that looks kind of like this.
It'll be some generic program
that's giving you a result from a vulnerability scan.
This one, what do you think it's doing?
I want you to pause the video and take a guess.
Alright, you're back?
Let's go ahead and see if you got the right answer.
What is this one telling you?
Well, they scanned a server,
and that server has an SSL certificate on it,
but it was expired as of the time of the scan.
In fact, it expired back in 2005.
That's a vulnerability.
They classify this as a low vulnerability,
and so it's probably something that we need to remediate.
Now how would we fix something like this?
Well, we'd have to go to the server,
and we'd have to install a new SSL certificate
or preferably TLS,
because it's a newer more secure technology.
How would we do that?
Well, you'd go to the server, and on this exam,
they're not going to give you a server to do it.
They'll just bring up this thing
that looks something like this,
and you'll be asked to install the certificate.
How do you do it?
Well, it's really easy.
You click the install certificate button,
you then select the certificate
from the file menu and install it.
So if you had something like this where they ask
what is the vulnerability and how to remediate it,
that's how you'd attack that problem.
So it's not real difficult here.
You just have to understand what you're looking at
when you read these reports.
To get comfortable with this type of a question,
I recommend you go to Google
and type in sample Nessus report.
You'll find the link directly to Nessus' homepage
on Tenable's website that has a sample report.
They have several of 'em.
And read through a couple of those,
and just get comfortable with what these reports are saying
and what the recommended remediations are.
Next, let's look at a log.
So we're going to have to analyze event logs.
So here's one.
What happened here?
Go ahead and pause, and then come back
and tell me if you think you figured it out.
Alright, you got it now?
Well hopefully you figured out that this
was a Windows event log for a logon process.
And in this case, what happened with it?
Well, there was a login failure.
Someone put in the wrong password,
or for some other reason, the account wasn't able to login.
So if you saw one of these, would that concern you?
Well, it wouldn't really concern me with one of them,
because one of them might mean
that I fat-fingered and typed in the wrong password.
But if I see two, three, four, five, six of these in a row,
now it's starting to look more like an attack,
like somebody's trying to guess my password.
And so if you see a lot of these in your Windows event logs,
that would be an issue.
Now for the exam, you don't need to know
that it's event number 4625, which is a logon failure,
but you do need to be able to read the log and be able
to either see the one on the left in the white,
which is a text log, or the graphical log on the right.
Either one is fair game on the test.
Now, what if we get this one?
What's happening on this one?
That's right.
This one is a successful login attempt.
And so if I see a failed login attempt
followed immediately by a successful login attempt,
and it's just one of one and then one of the other,
that's probably the user just guessed their password wrong.
Now if I start seeing five or ten failures
and then a successful one,
I'm going to start getting worried
and start looking at that account a little bit closer,
because it may be that the attacker
was successful in guessing your password,
and they're now logged on as you or the authorized user
and going through the network doing damage.
And so we'd want to start tracking
that user through the network.
So those are just some basic logons, failures,
and successes, and what they look like in Windows.
Now, let's go ahead and look at this next one.
This is a server log.
We're going to analyze this log.
Now I know there's a lot of information on the screen,
so feel free to pause and look at it
and be able to see if you can figure out what's going on.
Alright, so are you back?
Great.
Let's go ahead and look at this log
and analyze what's going on here.
First, what kind of server is this?
Well if we look at the first line,
you'll see about a third of the way over
that it is mail sv one, which stands for mail server.
That's what they've called their server.
So we know it's function is probably going to be serving mail.
And it's on an sshd daemon, which is port 22.
So someone is trying to login to ssh to this mail server.
Now if we move further to the right,
you'll see that there was a failed password
for the invalid user guest.
Then there was a failed password
for the invalid user post guest.
And then we had one for who is, and then info,
and then post guest, and then irc, and vpx,
and it keeps going down with invalid user.
What exactly is happening here?
Well, this looks to me like someone
is trying to brute force logon to this server.
They're probably using something like Hydra,
and they're going through every single common user account
that may exist on a Linux server
and seeing if they can login with it.
And so that's exactly what's happening here.
We have failed, failed, failed, failed, failed,
and we keep going all the way down,
we see a whole bunch of failures.
So to me, this looks like someone who is attempting
to get in but hasn't gotten in yet.
So let's look at this a different way.
Let's step back and take it,
not just on the mail servers log,
but we're going to look at this from our seam.
And so here, I have a seam, and I have filtered it down
to the mail server logs being displayed.
And here you can see the time
and the event that's occurring,
what server it was on, and what we think is happening.
And so here we have session closed for user D. Glover.
We have another one that says received disconnect by user.
And you keep going through,
and you start seeing failed password, failed password,
failed password, failed password, right?
Let's move on to the next screen
and take a look at these logs.
So we continue these logs down,
again, more failed passwords.
We have a session open by P. Smith.
Is that authorized?
Well, we can go look at who P. Smith is,
and it probably is an authorized user.
That's why they were successful in logging in.
And then we keep going.
Failed user, failed user, failed user.
We have another one.
Successful, The Rock as the user.
That may be a valid account.
And so you can see,
there's some successful attempts and some failed attempts.
As an incident responder or an analyst,
I'm going to look into those successful ones
and make sure that they are valid users that have logged in,
and not that somebody was finally
guessing the right password,
because we see this brute force logon attempt
that's occurring.
The next one we have here, here's another log.
Now, this one's going to be hard to read,
so I'm going to pull myself out of the image for a minute
and let you really focus on it.
Now here you can see a ton of stuff going on.
Now this looks like it is a web server log or a proxy log
that's capturing the request going to and from a server.
And so here you can see the source IP, the time it happened,
and the activity that was going on.
So in the first line, you see the source IP, that 24.12,
and then we see the time, February 15th,
and then we see what was happening.
It was a get request,
and it got the banner from a web server, http 1.1,
and you'll see that it also has the user string.
It's using Mozilla, which is Firefox.
They're running Windows NT 6.1,
and it came from a Firefox browser.
Next, we see that we have getting the style sheet,
and it's coming from churchcampfire.com.
Then we go down and we see get wp content
slash uploads slash something dot jpeg, right?
It's getting a picture off of this wp content folder.
Now what's wp content tell me?
Tells me it's WordPress, right?
Wp is a very common one used for WordPress.
And so this is a WordPress server.
And as we keep going through this,
we see a lot of get requests.
We're getting information from the server, right?
And then we have this update dot paypal one dot
campchurchfire.com slash information needs updating
and ID payment underscore info dot php.
So it's loading up some folder
asking them to update their payment information.
Now is this valid or not?
Well we don't really know
unless we know what this server is.
But as an analyst for that company,
you'd be able to figure that out.
Now the next big block here you see wp content
four or five times with a plugin folder.
And then if you look over to the right,
you'll see files for you dot exe, your resume dot exe,
files for you dot exe, your resume dot exe.
What is that?
Well it looks like it's trying
to run some sort of executable.
So it may be part of a command injection they're doing
to try to take over the server,
where they've uploaded something into this plugin folder
to some vulnerable plugin,
and now we're trying to run it, right?
So this is the way you got to start thinking
about these things.
As we keep moving through this, and you start looking,
it gets a little bit more jumbled
and a little bit more complicated,
but you start seeing that they're calling other things,
and they're going through product screens and categories.
And as they keep moving their way down,
they're going into a shopping cart.
And so this may be completely valid,
or this may be a sign of an attack.
And so it's something we have to look at carefully
as we figure out how this applies to our web server
and the way that it's built.
Now, the next screen here,
we're going to break that mess of a jumble back into our seam
and be able to look at it a little bit easier.
And so here, we can see it.
Again, it's going through the same process we just did,
but it's a lot easier to read.
Again, towards the bottom of the screen,
those ones in that wp content folder, those exe files,
that really is worrying me,
and I'd want to go look at those.
Are those malware?
Are those something that are being used
for command injection?
Are those used to be able to try to take remote control
of my server or take files off my server?
What are those things?
Because it's not very common that you're server
is running exe files as part of WordPress.
So that kind of looks a little funny to me,
and we would want to look closer into that.
Now if we go to the next screen here,
you'll see that we have, again,
we have that installed dot php.
That is kind of strange that you're going
to a default installation page, right?
Unless you're setting up this server brand new,
you probably shouldn't be going to that.
And so that may be a clue that there's something nefarious
going on here that we're going to want to look closer at.
And then you can start seeing as it goes
through the product screens, and the category screens,
and somebody's going through the shopping carts.
So maybe they're using something like Burp Suite,
and they're trying to do an injection of the data
between their browser and your server,
changing the product in the cart, changing the prices.
And so again, we're going to look at those logs
and analyze that with a lot more information
in the real world.
And so when it comes down to it,
what is happening in this series of logs?
Well, we're not exactly sure yet,
but we see a lot of things that worry us.
We have possible command injection.
We have possible default credentials that are being used,
such as the install dot php file.
That might be something that should have been taken off
after the server was installed, and it wasn't.
And so that's a backdoor on the way in.
We have this whole series of these things
going to and from the cart,
and you see this successful cart at the end.
Maybe they went through and changed prices.
So instead of being 999, it's now 99 cents, right?
There's all sorts of things that can be done.
And as we dig into these logs and start looking
at those purchases, and we start seeing what they were,
maybe we'd be able to figure out, is this valid activity,
or is this nefarious?
Now on the exam, your things are going to show you
nefarious things very quickly and very easily.
You're only going to get maybe 10 to 20 lines
of a particular log file,
'cause they're not going to give you a ton
of stuff to go through,
'cause you only have limited time.
But I just want you to get kind of comfortable
with the way some of these things look,
and you can start seeing what things tip me off
and I'd want to look at.
In the case of this, if I thought there
was something wrong with this WordPress server,
what would I do as a remediation for it?
Well, maybe I would put something
like a web application firewall in front of it to be able
to detect when bad things are going against that server.
And so a WAF, a web application firewall,
would be an adequate response
to something with unusual logs like this.
Now, the next one I want to look at here
is another example of logs.
Let's look at this one and figure out what's going on.
We have a user who initiated logoff.
We have special privileges assigned on the new login.
We have an account that was successfully logged into.
We have another account that was successfully logged into.
We have another account that's
using explicit credentials to login.
So we have a lot of logons and logoffs going on.
Now the first logoff was P. Smith.
The next logon was an admin.
Now is this something that's bad activity?
Well, that depends.
If we, as a admin, know that we were there
and doing this at 9:49pm, then it wouldn't be.
But if we were all home sleeping and this happened,
that could be a sign of privilege escalation.
Somebody was able to guess an admin password
and logon as the admin.
So that would be something we'd want to look into.
Going to the next screen here,
we have special privileges for the logon of system.
So now the system is logging on.
And then we have, again, another successful logon.
We have the local admin account being logged on.
We have special privileges for the system going on.
We have the account logging on as the local admin again.
And so we have a lot of these things that are happening
with a lot of successful logons.
So to me, it's either authorized activity,
or there's privilege escalation that's going on.
And we have to be careful,
and look into that, and figure it out.
And so here on the third screen,
we have more of the same, right,
another logon of the local account,
a logon for the network service,
a logon for the local account, and a logon for the system.
So, now we're going to look at this a different way.
So I pull up my seam, and I do a search,
and I'm looking through those Windows security logs,
and I'm looking for security enable.
What users have recently been added
into the special permissions like the admin group?
Well, here we see that this person gamer has been added.
Now, why is gamer being put into our admin group?
Well, we don't know, and we'd have to look into that.
Is this a valid account?
Maybe and maybe not.
Now for me if I saw something like this on exam day,
what would I be thinking?
Well I would be thinking
that a privilege escalation has occurred.
Somebody took over P. Smith's account,
they then switched to the admin account,
they've gotten the password, they've guessed it,
they've cracked it, whatever it was,
and now they're logged in as admin.
They might have gone through
and created this new account called gamer,
and then they've added gamer into the admin group.
Why?
Because if they got the domain admin account
or the local admin account,
the chances are eventually they're going to get caught,
and someone's going to change that password
to kick them off the system.
But if they've added other accounts
like gamer and put them in,
that gives them a backdoor access back in,
because they still have valid accounts
with valid user credentials.
And so this is one of those things that hackers do, right?
They break in the system,
and they start spreading out
by collecting additional accounts,
by getting additional passwords,
or creating their own accounts
so they can come back in later.
So I hope this log analysis and event ID analysis
and Nessus report analysis helps you guys out on test day.
I just wanted to give you kind of a quick sample of it
so you could start digging into it a little bit more.
Before the exam, I want you to go and find logs.
Pull up your Windows security event manager
and look through your stuff.
See what good stuff looks like,
so you can know what bad stuff looks like.
Go through and pull up those Nessus sample reports
and read through a couple of them.
It will make you feel more comfortable.
Because when you go do the simulations on exam day,
all the questions they're going to give you there
are going to be based on log analysis, event ID analysis,
or something like a Nessus report.
And being able to read through those
and then recommend remediations for these things
is going to be very important.
So in this case, we see that there was a gamer added.
He was put into the default admin group.
What are we going to do about that?
Well, we're going to delete this account, right?
That's a good way of doing it.
If you wanted to make sure you logged it in the future,
you'd put a seam in there.
You'd do some sort of a network tap so you can catch
that data and hopefully make it flag in like an ips
or an ids so the admins can look at it.
This is what you got to be thinking about is,
here's how I identify the problem,
and here's how I identify a solution,
because that's going to help you go far on test day.
(electronic tone)